Extracted

• • Target

    Wiprelyokcawpj.exe

  • Size

    1.3MB

  • MD5

    14239e8403667595f401b4971c28b3db

  • SHA1

    9b1afe3640abcde93657ff00d7ccf91efb7e652c

  • SHA256

    25c965edd039ebc00529a936e066f34149b4bb69c59c7a4fb575849584a71dda

  • SHA512

    fa4f817274d8c81581e79454c43ff704d1017f0ea7017a8422d9c4e897810d5c1108047082fe325391ba580f823e2d954d81e7774231ede4cb621226d2738b55

  • SSDEEP

    24576:vUrkF9ZT6xy9M7HCZmFq/wbgKcQrE/k2+gL5:vUwVk2XL

  Score

  10^/10

  modiloadertrojanformbookfadcpersistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2